Subject: [PATCH 1/2] Unify SSL_CONF to SSL_CONF_CTX

From: "Steffen (Daode) Nurpmeso" <[email-masked]>
Date: Tue, 9 Dec 2014 14:45:45 +0100

Conflicts:
	doc/apps/s_client.pod
	doc/apps/s_server.pod
		Remarks: adds missing documentation on SSL_CONF_CTX arguments.
	ssl/ssltest.c
---
 apps/s_cb.c                                        |  8 +--
 demos/bio/client-arg.c                             |  2 +-
 demos/bio/client-conf.c                            |  2 +-
 demos/bio/server-arg.c                             |  2 +-
 demos/bio/server-conf.c                            |  2 +-
 doc/apps/s_client.pod                              |  5 ++
 doc/apps/s_server.pod                              |  5 ++
 doc/ssl/{SSL_CONF_cmd.pod => SSL_CONF_CTX_cmd.pod} | 73 +++++++++++-----------
 ...CONF_cmd_argv.pod => SSL_CONF_CTX_cmd_argv.pod} | 12 ++--
 doc/ssl/SSL_CONF_CTX_new.pod                       |  4 +-
 doc/ssl/SSL_CONF_CTX_set1_prefix.pod               |  6 +-
 doc/ssl/SSL_CONF_CTX_set_flags.pod                 |  6 +-
 doc/ssl/SSL_CONF_CTX_set_ssl_ctx.pod               |  8 +--
 ssl/ssl.h                                          |  6 +-
 ssl/ssl_conf.c                                     |  8 +--
 ssl/ssl_err.c                                      |  2 +-
 util/ssleay.num                                    |  6 +-
 17 files changed, 84 insertions(+), 73 deletions(-)
 rename doc/ssl/{SSL_CONF_cmd.pod => SSL_CONF_CTX_cmd.pod} (85%)
 rename doc/ssl/{SSL_CONF_cmd_argv.pod => SSL_CONF_CTX_cmd_argv.pod} (68%)

diff --git a/apps/s_cb.c b/apps/s_cb.c
index 4b0e85d..37ccde2 100644
--- a/apps/s_cb.c
+++ b/apps/s_cb.c
@@ -1611,7 +1611,7 @@ int args_ssl(char ***pargs, int *pargc, SSL_CONF_CTX *cctx,
 	int rv;
 
 	/* Attempt to run SSL configuration command */
-	rv = SSL_CONF_cmd_argv(cctx, pargc, pargs);
+	rv = SSL_CONF_CTX_cmd_argv(cctx, pargc, pargs);
 	/* If parameter not recognised just return */
 	if (rv == 0)
 		return 0;
@@ -1671,7 +1671,7 @@ int args_ssl_call(SSL_CTX *ctx, BIO *err, SSL_CONF_CTX *cctx,
 			return 0;
 			}
 #endif
-		if (SSL_CONF_cmd(cctx, param, value) <= 0)
+		if (SSL_CONF_CTX_cmd(cctx, param, value) <= 0)
 			{
 			BIO_printf(err, "Error with command: \"%s %s\"\n",
 						param, value ? value : "");
@@ -1685,7 +1685,7 @@ int args_ssl_call(SSL_CTX *ctx, BIO *err, SSL_CONF_CTX *cctx,
 	 */
 	if (!no_ecdhe)
 		{
-		if (SSL_CONF_cmd(cctx, "-named_curve", "P-256") <= 0)
+		if (SSL_CONF_CTX_cmd(cctx, "-named_curve", "P-256") <= 0)
 			{
 			BIO_puts(err, "Error setting EC curve\n");
 			ERR_print_errors(err);
@@ -1695,7 +1695,7 @@ int args_ssl_call(SSL_CTX *ctx, BIO *err, SSL_CONF_CTX *cctx,
 #ifndef OPENSSL_NO_JPAKE
 	if (!no_jpake)
 		{
-		if (SSL_CONF_cmd(cctx, "-cipher", "PSK") <= 0)
+		if (SSL_CONF_CTX_cmd(cctx, "-cipher", "PSK") <= 0)
 			{
 			BIO_puts(err, "Error setting cipher to PSK\n");
 			ERR_print_errors(err);
diff --git a/demos/bio/client-arg.c b/demos/bio/client-arg.c
index cca7a1e..34035f5 100644
--- a/demos/bio/client-arg.c
+++ b/demos/bio/client-arg.c
@@ -25,7 +25,7 @@ int main(int argc, char **argv)
 		{
 		int rv;
 		/* Parse standard arguments */
-		rv = SSL_CONF_cmd_argv(cctx, &nargs, &args);
+		rv = SSL_CONF_CTX_cmd_argv(cctx, &nargs, &args);
 		if (rv == -3)
 			{
 			fprintf(stderr, "Missing argument for %s\n", *args);
diff --git a/demos/bio/client-conf.c b/demos/bio/client-conf.c
index 191615a..aec3c7b 100644
--- a/demos/bio/client-conf.c
+++ b/demos/bio/client-conf.c
@@ -47,7 +47,7 @@ int main(int argc, char **argv)
 	for (i = 0; i < sk_CONF_VALUE_num(sect); i++)
 		{
 		cnf = sk_CONF_VALUE_value(sect, i);
-		rv = SSL_CONF_cmd(cctx, cnf->name, cnf->value);
+		rv = SSL_CONF_CTX_cmd(cctx, cnf->name, cnf->value);
 		if (rv > 0)
 			continue;
 		if (rv != -2)
diff --git a/demos/bio/server-arg.c b/demos/bio/server-arg.c
index 0d432a4..6ba5cc4 100644
--- a/demos/bio/server-arg.c
+++ b/demos/bio/server-arg.c
@@ -41,7 +41,7 @@ int main(int argc, char *argv[])
 		{
 		int rv;
 		/* Parse standard arguments */
-		rv = SSL_CONF_cmd_argv(cctx, &nargs, &args);
+		rv = SSL_CONF_CTX_cmd_argv(cctx, &nargs, &args);
 		if (rv == -3)
 			{
 			fprintf(stderr, "Missing argument for %s\n", *args);
diff --git a/demos/bio/server-conf.c b/demos/bio/server-conf.c
index 0d940f0..f19b5b8 100644
--- a/demos/bio/server-conf.c
+++ b/demos/bio/server-conf.c
@@ -62,7 +62,7 @@ int main(int argc, char *argv[])
 		{
 		int rv;
 		cnf = sk_CONF_VALUE_value(sect, i);
-		rv = SSL_CONF_cmd(cctx, cnf->name, cnf->value);
+		rv = SSL_CONF_CTX_cmd(cctx, cnf->name, cnf->value);
 		if (rv > 0)
 			continue;
 		if (rv != -2)
diff --git a/doc/apps/s_client.pod b/doc/apps/s_client.pod
index aad59b1..c653f6c 100644
--- a/doc/apps/s_client.pod
+++ b/doc/apps/s_client.pod
@@ -62,6 +62,11 @@ SSL servers.
 
 =head1 OPTIONS
 
+In addition to the options below the B<s_client> utility also supports the
+common and client only options documented in the
+L<SSL_CONF_CTX_cmd(3)|SSL_CONF_CTX_cmd(3)/SUPPORTED COMMAND LINE COMMANDS>
+manual page.
+
 =over 4
 
 =item B<-connect host:port>
diff --git a/doc/apps/s_server.pod b/doc/apps/s_server.pod
index b37f410..ab36644 100644
--- a/doc/apps/s_server.pod
+++ b/doc/apps/s_server.pod
@@ -70,6 +70,11 @@ for connections on a given port using SSL/TLS.
 
 =head1 OPTIONS
 
+In addition to the options below the B<s_server> utility also supports the
+common and server only options documented in the
+L<SSL_CONF_CTX_cmd(3)|SSL_CONF_CTX_cmd(3)/SUPPORTED COMMAND LINE COMMANDS>
+manual page.
+
 =over 4
 
 =item B<-accept port>
diff --git a/doc/ssl/SSL_CONF_cmd.pod b/doc/ssl/SSL_CONF_CTX_cmd.pod
similarity index 85%
rename from doc/ssl/SSL_CONF_cmd.pod
rename to doc/ssl/SSL_CONF_CTX_cmd.pod
index 6d073cb..c10841b 100644
--- a/doc/ssl/SSL_CONF_cmd.pod
+++ b/doc/ssl/SSL_CONF_CTX_cmd.pod
@@ -2,26 +2,26 @@
 
 =head1 NAME
 
-SSL_CONF_cmd - send configuration command
+SSL_CONF_CTX_cmd - send configuration command
 
 =head1 SYNOPSIS
 
  #include <openssl/ssl.h>
 
- int SSL_CONF_cmd(SSL_CONF_CTX *cctx, const char *cmd, const char *value);
- int SSL_CONF_cmd_value_type(SSL_CONF_CTX *cctx, const char *cmd);
- int SSL_CONF_finish(SSL_CONF_CTX *cctx);
+ int SSL_CONF_CTX_cmd(SSL_CONF_CTX *cctx, const char *cmd, const char *value);
+ int SSL_CONF_CTX_cmd_value_type(SSL_CONF_CTX *cctx, const char *cmd);
+ int SSL_CONF_CTX_finish(SSL_CONF_CTX *cctx);
 
 =head1 DESCRIPTION
 
-The function SSL_CONF_cmd() performs configuration operation B<cmd> with
+The function SSL_CONF_CTX_cmd() performs configuration operation B<cmd> with
 optional parameter B<value> on B<ctx>. Its purpose is to simplify application
 configuration of B<SSL_CTX> or B<SSL> structures by providing a common
 framework for command line options or configuration files.
 
-SSL_CONF_cmd_value_type() returns the type of value that B<cmd> refers to.
+SSL_CONF_CTX_cmd_value_type() returns the type of value that B<cmd> refers to.
 
-The function SSL_CONF_finish() must be called after all configuration
+The function SSL_CONF_CTX_finish() must be called after all configuration
 operations have been completed. It is used to finalise any operations
 or to process defaults.
 
@@ -305,8 +305,8 @@ Set by default.
 
 =head1 SUPPORTED COMMAND TYPES
 
-The function SSL_CONF_cmd_value_type() currently returns one of the following
-types:
+The function SSL_CONF_CTX_cmd_value_type() currently returns one of the
+following types:
 
 =over 4
 
@@ -334,40 +334,40 @@ The value is a directory name.
 The order of operations is significant. This can be used to set either defaults
 or values which cannot be overridden. For example if an application calls:
 
- SSL_CONF_cmd(ctx, "Protocol", "-SSLv2");
- SSL_CONF_cmd(ctx, userparam, uservalue);
+ SSL_CONF_CTX_cmd(ctx, "Protocol", "-SSLv2");
+ SSL_CONF_CTX_cmd(ctx, userparam, uservalue);
 
 it will disable SSLv2 support by default but the user can override it. If 
 however the call sequence is:
 
- SSL_CONF_cmd(ctx, userparam, uservalue);
- SSL_CONF_cmd(ctx, "Protocol", "-SSLv2");
+ SSL_CONF_CTX_cmd(ctx, userparam, uservalue);
+ SSL_CONF_CTX_cmd(ctx, "Protocol", "-SSLv2");
 
 SSLv2 is B<always> disabled and attempt to override this by the user are
 ignored.
 
-By checking the return code of SSL_CTX_cmd() it is possible to query if a
-given B<cmd> is recognised, this is useful is SSL_CTX_cmd() values are
+By checking the return code of SSL_CONF_CTX_cmd() it is possible to query if
+a given B<cmd> is recognised, this is useful is SSL_CONF_CTX_cmd() values are
 mixed with additional application specific operations.
 
-For example an application might call SSL_CTX_cmd() and if it returns
+For example an application might call SSL_CONF_CTX_cmd() and if it returns
 -2 (unrecognised command) continue with processing of application specific
 commands.
 
-Applications can also use SSL_CTX_cmd() to process command lines though the
-utility function SSL_CTX_cmd_argv() is normally used instead. One way
-to do this is to set the prefix to an appropriate value using
+Applications can also use SSL_CONF_CTX_cmd() to process command lines though
+the utility function SSL_CONF_CTX_cmd_argv() is normally used instead.
+One way to do this is to set the prefix to an appropriate value using
 SSL_CONF_CTX_set1_prefix(), pass the current argument to B<cmd> and the
 following argument to B<value> (which may be NULL).
 
 In this case if the return value is positive then it is used to skip that
-number of arguments as they have been processed by SSL_CTX_cmd(). If -2 is
-returned then B<cmd> is not recognised and application specific arguments
-can be checked instead. If -3 is returned a required argument is missing
-and an error is indicated. If 0 is returned some other error occurred and
-this can be reported back to the user.
+number of arguments as they have been processed by SSL_CONF_CTX_cmd().
+If -2 is returned then B<cmd> is not recognised and application specific
+arguments can be checked instead. If -3 is returned a required argument is
+missing and an error is indicated. If 0 is returned some other error occurred
+and this can be reported back to the user.
 
-The function SSL_CONF_cmd_value_type() can be used by applications to 
+The function SSL_CONF_CTX_cmd_value_type() can be used by applications to 
 check for the existence of a command or to perform additional syntax
 checking or translation of the command value. For example if the return
 value is B<SSL_CONF_TYPE_FILE> an application could translate a relative
@@ -377,32 +377,33 @@ pathname to an absolute pathname.
 
 Set supported signature algorithms:
 
- SSL_CONF_cmd(ctx, "SignatureAlgorithms", "ECDSA+SHA256:RSA+SHA256:DSA+SHA256");
+ SSL_CONF_CTX_cmd(ctx, "SignatureAlgorithms",
+   "ECDSA+SHA256:RSA+SHA256:DSA+SHA256");
 
 Enable all protocols except SSLv3 and SSLv2:
 
- SSL_CONF_cmd(ctx, "Protocol", "ALL,-SSLv3,-SSLv2");
+ SSL_CONF_CTX_cmd(ctx, "Protocol", "ALL,-SSLv3,-SSLv2");
 
 Only enable TLSv1.2:
 
- SSL_CONF_cmd(ctx, "Protocol", "-ALL,TLSv1.2");
+ SSL_CONF_CTX_cmd(ctx, "Protocol", "-ALL,TLSv1.2");
 
 Disable TLS session tickets:
 
- SSL_CONF_cmd(ctx, "Options", "-SessionTicket");
+ SSL_CONF_CTX_cmd(ctx, "Options", "-SessionTicket");
 
 Set supported curves to P-256, P-384:
 
- SSL_CONF_cmd(ctx, "Curves", "P-256:P-384");
+ SSL_CONF_CTX_cmd(ctx, "Curves", "P-256:P-384");
 
 Set automatic support for any elliptic curve for key exchange:
 
- SSL_CONF_cmd(ctx, "ECDHParameters", "Automatic");
+ SSL_CONF_CTX_cmd(ctx, "ECDHParameters", "Automatic");
 
 =head1 RETURN VALUES
 
-SSL_CONF_cmd() returns 1 if the value of B<cmd> is recognised and B<value> is
-B<NOT> used and 2 if both B<cmd> and B<value> are used. In other words it
+SSL_CONF_CTX_cmd() returns 1 if the value of B<cmd> is recognised and B<value>
+is B<NOT> used and 2 if both B<cmd> and B<value> are used. In other words it
 returns the number of arguments processed. This is useful when processing
 command lines.
 
@@ -416,7 +417,7 @@ error occurred attempting to perform the operation: for example due to an
 error in the syntax of B<value> in this case the error queue may provide
 additional information.
 
-SSL_CONF_finish() returns 1 for success and 0 for failure.
+SSL_CONF_CTX_finish() returns 1 for success and 0 for failure.
 
 =head1 SEE ALSO
 
@@ -424,10 +425,10 @@ L<SSL_CONF_CTX_new(3)|SSL_CONF_CTX_new(3)>,
 L<SSL_CONF_CTX_set_flags(3)|SSL_CONF_CTX_set_flags(3)>,
 L<SSL_CONF_CTX_set1_prefix(3)|SSL_CONF_CTX_set1_prefix(3)>,
 L<SSL_CONF_CTX_set_ssl_ctx(3)|SSL_CONF_CTX_set_ssl_ctx(3)>,
-L<SSL_CONF_cmd_argv(3)|SSL_CONF_cmd_argv(3)>
+L<SSL_CONF_CTX_cmd_argv(3)|SSL_CONF_CTX_cmd_argv(3)>
 
 =head1 HISTORY
 
-SSL_CONF_cmd() was first added to OpenSSL 1.0.2
+SSL_CONF_CTX_cmd() was first added to OpenSSL 1.0.2
 
 =cut
diff --git a/doc/ssl/SSL_CONF_cmd_argv.pod b/doc/ssl/SSL_CONF_CTX_cmd_argv.pod
similarity index 68%
rename from doc/ssl/SSL_CONF_cmd_argv.pod
rename to doc/ssl/SSL_CONF_CTX_cmd_argv.pod
index 6e66441..b7eb831 100644
--- a/doc/ssl/SSL_CONF_cmd_argv.pod
+++ b/doc/ssl/SSL_CONF_CTX_cmd_argv.pod
@@ -2,25 +2,25 @@
 
 =head1 NAME
 
-SSL_CONF_cmd_argv - SSL configuration command line processing.
+SSL_CONF_CTX_cmd_argv - SSL configuration command line processing.
 
 =head1 SYNOPSIS
 
  #include <openssl/ssl.h>
 
- int SSL_CONF_cmd_argv(SSL_CONF_CTX *cctx, int *pargc, char ***pargv);
+ int SSL_CONF_CTX_cmd_argv(SSL_CONF_CTX *cctx, int *pargc, char ***pargv);
 
 =head1 DESCRIPTION
 
-The function SSL_CONF_cmd_argv() processes at most two command line
+The function SSL_CONF_CTX_cmd_argv() processes at most two command line
 arguments from B<pargv> and B<pargc>. The values of B<pargv> and B<pargc>
 are updated to reflect the number of command options processed. The B<pargc>
 argument can be set to B<NULL> is it is not used.
 
 =head1 RETURN VALUES
 
-SSL_CONF_cmd_argv() returns the number of command arguments processed: 0, 1, 2
-or a negative error code.
+SSL_CONF_CTX_cmd_argv() returns the number of command arguments processed: 0, 1,
+2 or a negative error code.
 
 If -2 is returned then an argument for a command is missing.
 
@@ -33,7 +33,7 @@ L<SSL_CONF_CTX_new(3)|SSL_CONF_CTX_new(3)>,
 L<SSL_CONF_CTX_set_flags(3)|SSL_CONF_CTX_set_flags(3)>,
 L<SSL_CONF_CTX_set1_prefix(3)|SSL_CONF_CTX_set1_prefix(3)>,
 L<SSL_CONF_CTX_set_ssl_ctx(3)|SSL_CONF_CTX_set_ssl_ctx(3)>,
-L<SSL_CONF_cmd(3)|SSL_CONF_cmd(3)>
+L<SSL_CONF_CTX_cmd(3)|SSL_CONF_CTX_cmd(3)>
 
 =head1 HISTORY
 
diff --git a/doc/ssl/SSL_CONF_CTX_new.pod b/doc/ssl/SSL_CONF_CTX_new.pod
index a9ccb04..d625901 100644
--- a/doc/ssl/SSL_CONF_CTX_new.pod
+++ b/doc/ssl/SSL_CONF_CTX_new.pod
@@ -30,8 +30,8 @@ SSL_CONF_CTX_free() does not return a value.
 L<SSL_CONF_CTX_set_flags(3)|SSL_CONF_CTX_set_flags(3)>,
 L<SSL_CONF_CTX_set_ssl_ctx(3)|SSL_CONF_CTX_set_ssl_ctx(3)>,
 L<SSL_CONF_CTX_set1_prefix(3)|SSL_CONF_CTX_set1_prefix(3)>,
-L<SSL_CONF_cmd(3)|SSL_CONF_cmd(3)>,
-L<SSL_CONF_cmd_argv(3)|SSL_CONF_cmd_argv(3)>
+L<SSL_CONF_CTX_cmd(3)|SSL_CONF_CTX_cmd(3)>,
+L<SSL_CONF_CTX_cmd_argv(3)|SSL_CONF_CTX_cmd_argv(3)>
 
 =head1 HISTORY
 
diff --git a/doc/ssl/SSL_CONF_CTX_set1_prefix.pod b/doc/ssl/SSL_CONF_CTX_set1_prefix.pod
index 7699018..2e9c728 100644
--- a/doc/ssl/SSL_CONF_CTX_set1_prefix.pod
+++ b/doc/ssl/SSL_CONF_CTX_set1_prefix.pod
@@ -17,7 +17,7 @@ to B<prefix>. If B<prefix> is B<NULL> it is restored to the default value.
 
 =head1 NOTES
 
-Command prefixes alter the commands recognised by subsequent SSL_CTX_cmd()
+Command prefixes alter the commands recognised by subsequent SSL_CONF_CTX_cmd()
 calls. For example for files, if the prefix "SSL" is set then command names
 such as "SSLProtocol", "SSLOptions" etc. are recognised instead of "Protocol"
 and "Options". Similarly for command lines if the prefix is "--ssl-" then 
@@ -39,8 +39,8 @@ SSL_CONF_CTX_set1_prefix() returns 1 for success and 0 for failure.
 L<SSL_CONF_CTX_new(3)|SSL_CONF_CTX_new(3)>,
 L<SSL_CONF_CTX_set_flags(3)|SSL_CONF_CTX_set_flags(3)>,
 L<SSL_CONF_CTX_set_ssl_ctx(3)|SSL_CONF_CTX_set_ssl_ctx(3)>,
-L<SSL_CONF_cmd(3)|SSL_CONF_cmd(3)>,
-L<SSL_CONF_cmd_argv(3)|SSL_CONF_cmd_argv(3)>
+L<SSL_CONF_CTX_cmd(3)|SSL_CONF_CTX_cmd(3)>,
+L<SSL_CONF_CTX_cmd_argv(3)|SSL_CONF_CTX_cmd_argv(3)>
 
 =head1 HISTORY
 
diff --git a/doc/ssl/SSL_CONF_CTX_set_flags.pod b/doc/ssl/SSL_CONF_CTX_set_flags.pod
index ab87efc..f4c467d 100644
--- a/doc/ssl/SSL_CONF_CTX_set_flags.pod
+++ b/doc/ssl/SSL_CONF_CTX_set_flags.pod
@@ -19,7 +19,7 @@ The function SSL_CONF_CTX_clear_flags() clears B<flags> in the context B<cctx>.
 
 =head1 NOTES
 
-The flags set affect how subsequent calls to SSL_CONF_cmd() or
+The flags set affect how subsequent calls to SSL_CONF_CTX_cmd() or
 SSL_CONF_argv() behave.
 
 Currently the following B<flags> values are recognised:
@@ -58,8 +58,8 @@ value after setting or clearing flags.
 L<SSL_CONF_CTX_new(3)|SSL_CONF_CTX_new(3)>,
 L<SSL_CONF_CTX_set_ssl_ctx(3)|SSL_CONF_CTX_set_ssl_ctx(3)>,
 L<SSL_CONF_CTX_set1_prefix(3)|SSL_CONF_CTX_set1_prefix(3)>,
-L<SSL_CONF_cmd(3)|SSL_CONF_cmd(3)>,
-L<SSL_CONF_cmd_argv(3)|SSL_CONF_cmd_argv(3)>
+L<SSL_CONF_CTX_cmd(3)|SSL_CONF_CTX_cmd(3)>,
+L<SSL_CONF_CTX_cmd_argv(3)|SSL_CONF_CTX_cmd_argv(3)>
 
 =head1 HISTORY
 
diff --git a/doc/ssl/SSL_CONF_CTX_set_ssl_ctx.pod b/doc/ssl/SSL_CONF_CTX_set_ssl_ctx.pod
index 2049a53..6550ab8 100644
--- a/doc/ssl/SSL_CONF_CTX_set_ssl_ctx.pod
+++ b/doc/ssl/SSL_CONF_CTX_set_ssl_ctx.pod
@@ -15,12 +15,12 @@ SSL_CONF_CTX_set_ssl_ctx, SSL_CONF_CTX_set_ssl - set context to configure
 
 SSL_CONF_CTX_set_ssl_ctx() sets the context associated with B<cctx> to the
 B<SSL_CTX> structure B<ctx>. Any previous B<SSL> or B<SSL_CTX> associated with
-B<cctx> is cleared. Subsequent calls to SSL_CONF_cmd() will be sent to
+B<cctx> is cleared. Subsequent calls to SSL_CONF_CTX_cmd() will be sent to
 B<ctx>.
 
 SSL_CONF_CTX_set_ssl() sets the context associated with B<cctx> to the
 B<SSL> structure B<ssl>. Any previous B<SSL> or B<SSL_CTX> associated with
-B<cctx> is cleared. Subsequent calls to SSL_CONF_cmd() will be sent to
+B<cctx> is cleared. Subsequent calls to SSL_CONF_CTX_cmd() will be sent to
 B<ssl>.
 
 =head1 NOTES
@@ -37,8 +37,8 @@ SSL_CONF_CTX_set_ssl_ctx() and SSL_CTX_set_ssl() do not return a value.
 L<SSL_CONF_CTX_new(3)|SSL_CONF_CTX_new(3)>,
 L<SSL_CONF_CTX_set_flags(3)|SSL_CONF_CTX_set_flags(3)>,
 L<SSL_CONF_CTX_set1_prefix(3)|SSL_CONF_CTX_set1_prefix(3)>,
-L<SSL_CONF_cmd(3)|SSL_CONF_cmd(3)>,
-L<SSL_CONF_cmd_argv(3)|SSL_CONF_cmd_argv(3)>
+L<SSL_CONF_CTX_cmd(3)|SSL_CONF_CTX_cmd(3)>,
+L<SSL_CONF_CTX_cmd_argv(3)|SSL_CONF_CTX_cmd_argv(3)>
 
 =head1 HISTORY
 
diff --git a/ssl/ssl.h b/ssl/ssl.h
index a5af6fc..704315c 100644
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -2442,9 +2442,9 @@ int SSL_CONF_CTX_set1_prefix(SSL_CONF_CTX *cctx, const char *pre);
 void SSL_CONF_CTX_set_ssl(SSL_CONF_CTX *cctx, SSL *ssl);
 void SSL_CONF_CTX_set_ssl_ctx(SSL_CONF_CTX *cctx, SSL_CTX *ctx);
 
-int SSL_CONF_cmd(SSL_CONF_CTX *cctx, const char *cmd, const char *value);
-int SSL_CONF_cmd_argv(SSL_CONF_CTX *cctx, int *pargc, char ***pargv);
-int SSL_CONF_cmd_value_type(SSL_CONF_CTX *cctx, const char *cmd);
+int SSL_CONF_CTX_cmd(SSL_CONF_CTX *cctx, const char *cmd, const char *value);
+int SSL_CONF_CTX_cmd_argv(SSL_CONF_CTX *cctx, int *pargc, char ***pargv);
+int SSL_CONF_CTX_cmd_value_type(SSL_CONF_CTX *cctx, const char *cmd);
 
 #ifndef OPENSSL_NO_SSL_TRACE
 void SSL_trace(int write_p, int version, int content_type,
diff --git a/ssl/ssl_conf.c b/ssl/ssl_conf.c
index 957b0b5..ed0091e 100644
--- a/ssl/ssl_conf.c
+++ b/ssl/ssl_conf.c
@@ -510,7 +510,7 @@ static const ssl_conf_cmd_tbl *ssl_conf_cmd_lookup(SSL_CONF_CTX *cctx, const cha
 	return NULL;
 	}
 
-int SSL_CONF_cmd(SSL_CONF_CTX *cctx, const char *cmd, const char *value)
+int SSL_CONF_CTX_cmd(SSL_CONF_CTX *cctx, const char *cmd, const char *value)
 	{
 	const ssl_conf_cmd_tbl *runcmd;
 	if (cmd == NULL)
@@ -557,7 +557,7 @@ int SSL_CONF_cmd(SSL_CONF_CTX *cctx, const char *cmd, const char *value)
 	return -2;
 	}
 
-int SSL_CONF_cmd_argv(SSL_CONF_CTX *cctx, int *pargc, char ***pargv)
+int SSL_CONF_CTX_cmd_argv(SSL_CONF_CTX *cctx, int *pargc, char ***pargv)
 	{
 	int rv;
 	const char *arg = NULL, *argn;
@@ -573,7 +573,7 @@ int SSL_CONF_cmd_argv(SSL_CONF_CTX *cctx, int *pargc, char ***pargv)
 		argn = NULL;
 	cctx->flags &= ~SSL_CONF_FLAG_FILE;
 	cctx->flags |= SSL_CONF_FLAG_CMDLINE;
-	rv = SSL_CONF_cmd(cctx, arg, argn);
+	rv = SSL_CONF_CTX_cmd(cctx, arg, argn);
 	if (rv > 0)
 		{
 		/* Success: update pargc, pargv */
@@ -591,7 +591,7 @@ int SSL_CONF_cmd_argv(SSL_CONF_CTX *cctx, int *pargc, char ***pargv)
 	return rv;
 	}
 
-int SSL_CONF_cmd_value_type(SSL_CONF_CTX *cctx, const char *cmd)
+int SSL_CONF_CTX_cmd_value_type(SSL_CONF_CTX *cctx, const char *cmd)
 	{
 	if (ssl_conf_cmd_skip_prefix(cctx, &cmd))
 		{
diff --git a/ssl/ssl_err.c b/ssl/ssl_err.c
index fd63d37..37729e4 100644
--- a/ssl/ssl_err.c
+++ b/ssl/ssl_err.c
@@ -205,7 +205,7 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_SSL_CIPHER_STRENGTH_SORT),	"SSL_CIPHER_STRENGTH_SORT"},
 {ERR_FUNC(SSL_F_SSL_CLEAR),	"SSL_clear"},
 {ERR_FUNC(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD),	"SSL_COMP_add_compression_method"},
-{ERR_FUNC(SSL_F_SSL_CONF_CMD),	"SSL_CONF_cmd"},
+{ERR_FUNC(SSL_F_SSL_CONF_CMD),	"SSL_CONF_CTX_cmd"},
 {ERR_FUNC(SSL_F_SSL_CREATE_CIPHER_LIST),	"ssl_create_cipher_list"},
 {ERR_FUNC(SSL_F_SSL_CTRL),	"SSL_ctrl"},
 {ERR_FUNC(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY),	"SSL_CTX_check_private_key"},
diff --git a/util/ssleay.num b/util/ssleay.num
index 5a89913..d42b284 100755
--- a/util/ssleay.num
+++ b/util/ssleay.num
@@ -330,7 +330,7 @@ DTLS_client_method                      368	EXIST::FUNCTION:
 SSL_CIPHER_standard_name                369	EXIST::FUNCTION:SSL_TRACE
 SSL_set_alpn_protos                     370	EXIST::FUNCTION:
 SSL_CTX_set_srv_supp_data               371	NOEXIST::FUNCTION:
-SSL_CONF_cmd_argv                       372	EXIST::FUNCTION:
+SSL_CONF_CTX_cmd_argv                   372	EXIST::FUNCTION:
 DTLSv1_2_server_method                  373	EXIST::FUNCTION:
 SSL_COMP_set0_compression_methods       374	EXIST:!VMS:FUNCTION:COMP
 SSL_COMP_set0_compress_methods          374	EXIST:VMS:FUNCTION:COMP
@@ -338,7 +338,7 @@ SSL_CTX_set_cert_cb                     375	EXIST::FUNCTION:
 SSL_CTX_add_client_custom_ext           376	EXIST::FUNCTION:TLSEXT
 SSL_is_server                           377	EXIST::FUNCTION:
 SSL_CTX_get0_param                      378	EXIST::FUNCTION:
-SSL_CONF_cmd                            379	EXIST::FUNCTION:
+SSL_CONF_CTX_cmd                        379	EXIST::FUNCTION:
 SSL_CTX_get_ssl_method                  380	EXIST::FUNCTION:
 SSL_CONF_CTX_set_ssl_ctx                381	EXIST::FUNCTION:
 SSL_CIPHER_find                         382	EXIST::FUNCTION:
@@ -350,7 +350,7 @@ SSL_CTX_set_alpn_protos                 387	EXIST::FUNCTION:
 SSL_CTX_add_server_custom_ext           389	EXIST::FUNCTION:TLSEXT
 SSL_CTX_get0_certificate                390	EXIST::FUNCTION:
 SSL_CTX_set_alpn_select_cb              391	EXIST::FUNCTION:
-SSL_CONF_cmd_value_type                 392	EXIST::FUNCTION:
+SSL_CONF_CTX_cmd_value_type             392	EXIST::FUNCTION:
 SSL_set_cert_cb                         393	EXIST::FUNCTION:
 SSL_get_sigalgs                         394	EXIST::FUNCTION:TLSEXT
 SSL_CONF_CTX_set1_prefix                395	EXIST::FUNCTION:
-- 
2.1.0

---

From: "Steffen (Daode) Nurpmeso" <[email-masked]>
Date: Tue, 9 Dec 2014 14:45:48 +0100

Conflicts:
	doc/ssl/SSL_CONF_CTX_cmd.pod
---
 doc/ssl/SSL_CONF_CTX_cmd.pod | 40 ++++++++++++++++++++++++++++++----------
 ssl/ssl_conf.c               |  6 +++++-
 2 files changed, 35 insertions(+), 11 deletions(-)

diff --git a/doc/ssl/SSL_CONF_CTX_cmd.pod b/doc/ssl/SSL_CONF_CTX_cmd.pod
index c10841b..4b274bd 100644
--- a/doc/ssl/SSL_CONF_CTX_cmd.pod
+++ b/doc/ssl/SSL_CONF_CTX_cmd.pod
@@ -74,7 +74,7 @@ B<prime256v1>). Curve names are case sensitive.
 
 =item B<-named_curve>
 
-This sets the temporary curve used for ephemeral ECDH modes. Only used by 
+This sets the temporary curve used for ephemeral ECDH modes. Only used by
 servers
 
 The B<value> argument is a curve name or the special value B<auto> which
@@ -85,7 +85,7 @@ can be either the B<NIST> name (e.g. B<P-256>) or an OpenSSL OID name
 =item B<-cipher>
 
 Sets the cipher suite list to B<value>. Note: syntax checking of B<value> is
-currently not performed unless a B<SSL> or B<SSL_CTX> structure is 
+currently not performed unless a B<SSL> or B<SSL_CTX> structure is
 associated with B<cctx>.
 
 =item B<-cert>
@@ -111,7 +111,7 @@ operations are permitted.
 
 =item B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>
 
-Disables protocol support for SSLv2, SSLv3, TLS 1.0, TLS 1.1 or TLS 1.2 
+Disables protocol support for SSLv2, SSLv3, TLS 1.0, TLS 1.1 or TLS 1.2
 by setting the corresponding options B<SSL_OP_NO_SSL2>, B<SSL_OP_NO_SSL3>,
 B<SSL_OP_NO_TLS1>, B<SSL_OP_NO_TLS1_1> and B<SSL_OP_NO_TLS1_2> respectively.
 
@@ -177,7 +177,7 @@ Note: the command prefix (if set) alters the recognised B<cmd> values.
 =item B<CipherString>
 
 Sets the cipher suite list to B<value>. Note: syntax checking of B<value> is
-currently not performed unless an B<SSL> or B<SSL_CTX> structure is 
+currently not performed unless an B<SSL> or B<SSL_CTX> structure is
 associated with B<cctx>.
 
 =item B<Certificate>
@@ -239,7 +239,7 @@ B<prime256v1>). Curve names are case sensitive.
 
 =item B<ECDHParameters>
 
-This sets the temporary curve used for ephemeral ECDH modes. Only used by 
+This sets the temporary curve used for ephemeral ECDH modes. Only used by
 servers
 
 The B<value> argument is a curve name or the special value B<Automatic> which
@@ -254,9 +254,17 @@ The supported versions of the SSL or TLS protocol.
 The B<value> argument is a comma separated list of supported protocols to
 enable or disable. If an protocol is preceded by B<-> that version is disabled.
 All versions are enabled by default, though applications may choose to
-explicitly disable some. Currently supported protocol values are B<SSLv2>,
-B<SSLv3>, B<TLSv1>, B<TLSv1.1> and B<TLSv1.2>. The special value B<ALL> refers
-to all supported versions.
+explicitly disable some.
+Currently supported protocol values are
+B<SSLv2>, B<SSLv3>, B<TLSv1>, B<TLSv1.1> and B<TLSv1.2>.
+
+Some special values are understood:
+B<ALL> refers to all supported versions,
+B<NEWEST> will always refer to the newest of the supported protocols,
+currently B<TLSv1.2>,
+B<OLDEST> refers to the oldest supported protocol, currently B<SSLv2>,
+and B<VULNERABLE> includes all protocols which have known vulnerabilities
+(in the default configuration).
 
 =item B<Options>
 
@@ -337,7 +345,7 @@ or values which cannot be overridden. For example if an application calls:
  SSL_CONF_CTX_cmd(ctx, "Protocol", "-SSLv2");
  SSL_CONF_CTX_cmd(ctx, userparam, uservalue);
 
-it will disable SSLv2 support by default but the user can override it. If 
+it will disable SSLv2 support by default but the user can override it. If
 however the call sequence is:
 
  SSL_CONF_CTX_cmd(ctx, userparam, uservalue);
@@ -367,7 +375,7 @@ arguments can be checked instead. If -3 is returned a required argument is
 missing and an error is indicated. If 0 is returned some other error occurred
 and this can be reported back to the user.
 
-The function SSL_CONF_CTX_cmd_value_type() can be used by applications to 
+The function SSL_CONF_CTX_cmd_value_type() can be used by applications to
 check for the existence of a command or to perform additional syntax
 checking or translation of the command value. For example if the return
 value is B<SSL_CONF_TYPE_FILE> an application could translate a relative
@@ -384,10 +392,22 @@ Enable all protocols except SSLv3 and SSLv2:
 
  SSL_CONF_CTX_cmd(ctx, "Protocol", "ALL,-SSLv3,-SSLv2");
 
+Disable the oldest protocol:
+
+ SSL_CONF_CTX_cmd(ctx, "Protocol", "ALL,-OLDEST");
+
+Disable protocols which have known vulnerabilities:
+
+ SSL_CONF_CTX_cmd(ctx, "Protocol", "ALL,-VULNERABLE");
+
 Only enable TLSv1.2:
 
  SSL_CONF_CTX_cmd(ctx, "Protocol", "-ALL,TLSv1.2");
 
+Only enable the newest protocol:
+
+ SSL_CONF_CTX_cmd(ctx, "Protocol", "-ALL,NEWEST");
+
 Disable TLS session tickets:
 
  SSL_CONF_CTX_cmd(ctx, "Options", "-SessionTicket");
diff --git a/ssl/ssl_conf.c b/ssl/ssl_conf.c
index ed0091e..b5fd7b6 100644
--- a/ssl/ssl_conf.c
+++ b/ssl/ssl_conf.c
@@ -338,7 +338,11 @@ static int cmd_Protocol(SSL_CONF_CTX *cctx, const char *value)
 		SSL_FLAG_TBL_INV("SSLv3", SSL_OP_NO_SSLv3),
 		SSL_FLAG_TBL_INV("TLSv1", SSL_OP_NO_TLSv1),
 		SSL_FLAG_TBL_INV("TLSv1.1", SSL_OP_NO_TLSv1_1),
-		SSL_FLAG_TBL_INV("TLSv1.2", SSL_OP_NO_TLSv1_2)
+		SSL_FLAG_TBL_INV("TLSv1.2", SSL_OP_NO_TLSv1_2),
+		SSL_FLAG_TBL_INV("OLDEST", SSL_OP_NO_SSLv2),
+		SSL_FLAG_TBL_INV("NEWEST", SSL_OP_NO_TLSv1_2),
+		SSL_FLAG_TBL_INV("VULNERABLE",
+			SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3),
 		};
 	if (!(cctx->flags & SSL_CONF_FLAG_FILE))
 		return -2;
-- 
2.1.0